Digital Forensics

Digital forensics is that part of the science of forensics that treats the recovery and investigation of information stored digitally. Digital forensics is frequently used in the investigation of computer crime. Digital forensics generally consists of three stages: the acquisition of information, analysis, and reporting of findings.

Digital forensics came of age in the 1980s and 1990s, as various law enforcement agencies, especially the FBI, recognized the growing trend in using computers to commit crimes. By the beginning of the 21st century, much of the focus of digital forensics centers on both mobile devices and the Internet. Internet crime, particularly cyber warfare and cyber terrorism, are an increasing area of concern around the globe.

Digital forensics can be broken down into several subcategories, including computer forensics that frequently recovers information from physical devices, and mobile device forensics, which often recovers information from call data and SMS or email. Network forensics monitors the Internet, attempting to trace network intrusions.

In a court of law, digital evidence recovered by a forensics expert is treated similarly to physical evidence. Laws concerning digital evidence treat the integrity and authenticity of the evidence, ensuring that the seizure of the information has not corrupted or changed it and establishing a secure chain of custody.